CPCSC compliance consulting
A paid CPCSC readiness engagement helps Canadian defence suppliers scope the contract, close control gaps, and prepare the documents and evidence needed for the named level.
The readiness call is free. Written findings and implementation begin only after you approve a paid scope.
The RFP names CPCSC. Now what?
Your bid is moving, and the clause may set work that must be ready by award. Bring the clause and what you know today.
We start by finding the Specified Information, systems, people, cloud services, and suppliers it actually covers. That boundary comes before a control map.
Nelson leads the readiness call and stays involved through scoping and handoff. You are not passed from a sales conversation to an anonymous delivery team.
Nelson is a real pro who helped us through a difficult time of transition. He helped us identify many gaps in our systems, processes and structure.Client feedback from an AWS infrastructure review, shared here as adjacent technical work.
You do not need every program detail at once. Start with the level in the contract and the Specified Information your team will handle.
Level 1 covers 13 controls. When it is required, the supplier completes the self-assessment and keeps the records that support its answers.
Level 2 is under development. Government guidance says it will consist of 98 controls and use accredited external assessments plus an annual affirmation once available.
The contract or solicitation identifies whether CPCSC applies and which level is required. Confirm the clause, scope, and current Government of Canada guidance before acting.
What working together looks like
Each decision feeds the next. Scope comes before remediation. Documentation follows what is actually in place. The handoff ties the boundary, findings, agreed work, and supporting records together so your team knows what it owns.
Read the clause, confirm the level, and follow the Specified Information path through people, systems, cloud services, and suppliers. Everyone works from the same boundary.
Review the applicable controls alongside the documents, settings, records, and owner knowledge that exist today. The findings stay tied to the real environment.
Order remediation by contract need and dependency, then support implementation where it is part of the scope. Your team can see what happens next and who owns it.
Organize policies, diagrams, records, and review notes so the evidence matches how the controls operate. The supporting records have a home and an owner.
After the readiness call
The proposal names the exact scope. Depending on what we agree, the work may include:
Timelines depend on the contract scope, current controls, and access to supporting records. Fees also depend on whether you need advice or hands-on implementation. The proposal sets both before paid work starts.
The first conversation
We use the free call to understand the clause, timing, and where you are stuck. Bring the clause if you have it. The call does not include a control-by-control assessment or written gap report.
If paid work makes sense, the proposal defines the scope, outputs, timing, and fees before work begins.
CPCSC applies through Canadian defence contracts. CMMC applies through U.S. defence contracts. Check the clause before you plan the work.
The contract or solicitation identifies the requirement and level. Start with the CPCSC clause and the information it says must be protected.
No. Pilotcore supports preparation and implementation. Official certification and assessment decisions stay with the applicable program process or accredited body.
Yes. Level 1 is a supplier self-assessment. Outside support can help when the boundary, implementation work, documentation, or evidence ownership is unclear.
Timing and fees depend on the contract scope, current controls, access to supporting records, and whether Pilotcore advises or implements. If there is a fit, the proposal sets the work, timing, and fees before paid work begins.
Choose the next useful step
Talk through the requirement with us, or work through Level 1 yourself. The right starting point depends on what is unclear.
Talk it through
Decide whether paid preparation, focused remediation, or self-directed work fits the requirement.
Start on your own
See what to gather and what to check before completing the supplier self-assessment.
